Hacker News Reader

moonbootson Github SSL replaced by self-signed certificate in China

Fortunately, it looks like Chrome prevents users from clicking past the ssl errors. This Chinese chrome screenshot[1] shows that there's only a back button (for English versions of this page, see [2]). Unfortunately, it appears that IE allows users to click past the errors[3]. I'm also interested in how the 360 browser[4], which has been gaining market share in China, handles the error.

Does anyone have any theories why China would use a self signed certificate when it's very indiscreet? A lot of users will just click through if given the opportunity (around 60% in chrome before new security measures prevented it[2]), but I doubt many users with truly sensitive private repos would do this.

[1] https://twitter.com/GreatFireChina/status/295236912594186240...

[2] http://www.imperialviolet.org/2012/07/19/hope9talk.html

[3] https://twitter.com/chenshaoju/status/295139636718743552/pho...

[4] http://news.ycombinator.com/item?id=4499168

moonbootson Javascript Cryptography Considered Harmful

The problem with running crypto code in Javascript is that practically any function that the crypto depends on could be overridden silently by any piece of content used to build the hosting page.

Ecmascript 5, the latest version of the Javascript standard, provides the ability to lock down the malleable runtime. Functions can be frozen so that no later code can overwrite or change their behavior. For more information, see this talk[1] by Mario Heiderich in 2011 or his slides[2].

[1] https://www.youtube.com/watch?v=yuNfO6I6pEA

[2] https://www.owasp.org/images/a/a3/Mario_Heiderich_OWASP_Swed...

moonbootson Tips to accelerate SSL

The overhead of newer ephemeral elliptic curve diffie hellman is as low as 15% compared to rsa[1].

[1] http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-se...

moonbootson Introducing Drake, a kind of ‘make for data’

Redo lacks features baked into Drake, especially the Hadoop integration, but I believe it would be easier to incorporate custom functionality into redo versus hacking Make or writing a custom build system. I haven't used Drake, so I would be interested in a small but complicated Drake script which tackles an intractable problem in Make. I don't claim redo can provide a cleaner solution than a purpose-built system, but I think it will be unexpectedly simple.

moonbootson Introducing Drake, a kind of ‘make for data’

Djb redo[1], a make alternative, feels like a good fit for these type of data manipulation and dependency representations. Below is a port of the first example. The build script is just shell, so you can do stuff like embed python with a heredoc. One bit of syntactic sugar is that redo assumes stdout is the desired contents of the generated file, so you don't need to explicitly pipe to an OUTPUT variable.

  #!/bin/sh
  case $1 in
  contracts.csv)
    curl http://www.ferc.gov/docs-filing/eqr/soft-tools/sample-csv/contract.txt
    ;;
  evergreens.csv)
    redo-ifchange contracts.csv
    grep Evergreen contracts.csv
    ;;
  report.txt)
    input=evergreens.csv
    redo-ifchange $input
    python2 <<-EOF
  linecount = len(file("$input").readlines())
  print("File $input has {0} lines.\n".format(linecount))
  EOF
    ;;
  esac

[1] https://github.com/apenwarr/redo

moonbootson Show HN: Type Zebra - Test your fonts in a web browser

In chrome, I'm not seeing the flash warning message. I'm only seeing an endless "Loading your fonts..." I have click-to-play flash enabled.

Webfontloader[1] uses javascript to detect whether a specific font is available. They use a hack where they change the font of a piece of text and calculate whether the width has changed, indicating the system is using specified font instead of the default serif or san serif. If you had a large list of fonts, you could filter out the ones the user has.

[1] https://github.com/typekit/webfontloader.git

moonbootson Ask HN: What are the best resources to learn shell scripting?

A good intro is a talk given by Ryan Tomayko called the Shell Hater's Handbook[1]. His POSIX Shell and Utilities is also a great reference[2]. For a more comprehensive guide, I recommend the dash man pages[3]. Dash is shell, the good parts.

[1] http://shellhaters.heroku.com/ [2] http://shellhaters.heroku.com/posix [3] http://linux.die.net/man/1/dash

moonbootson Want to learn to code? Don't copy and paste, type out other people's code

I created http://typing.io primarily to help programmers practice typing, but it also allows users to explore open source code like jQuery and Rails by typing through instead of just reading.

moonbootson Pushing Nginx to its limit with Lua

I'm using nginx+lua as the backend to http://typing.io, and I've found the combination to be a fast and robust alternative to more full featured web stacks like Rails.

moonbootson Chinese Architecture, Old and New

As a side note, I love the slideshow UI. The keyboard navigation (j/k or left/right) brings each picture flush against the top of the screen. I hate when I need to manually scroll down to bring the picture into full view and hide the navigation boilerplate, especially when a site uses full page refreshes instead of ajax. Unlike more interactive slideshows, this page still works normally without javascript or if the user just prefers scrolling.

moonbootson Kung Fu Typing - Keyboard Finger Movement Diagrams

I can only imagine how much hairier these diagrams become if generated from code instead of English/html. Even for the best case scenario of "The Robot" combined with an "ergonomic" layout like dvorak or colemak, the right pinky area would be a tangle of deep purple. If the diagrams were updated to include backspace key usage, the mess only gets worse.

I couldn't find a typing tutor that addressed the difficulty of typing the symbols in code, so I created a webapp called http://typing.io. It allows programmers to practice typing open source code instead of English or drills.

moonbootson OCSP Stapling: How CloudFlare Just Made SSL 30% Faster

I'm a fan of cloudflare, but I'm disappointed they didn't thank or mention nginx in this blog post. Cloudflare uses nginx, which recently released OCSP support thanks to sponsorship from Comodo, DigiCert, and GlobalSign [1].

[1] http://nginx.org/en/CHANGES

moonbootson The keyboard layout project

Thanks for the feedback. Occasionally I also find myself typing opening brace, closing brace, left arrow, inner text, and right arrow. However, it's very inefficient to jump to the arrow keys, so I want to discourage this typing pattern.

To keep braces/quotes balanced, I've been using editor plugins like smartinput[1] and paredit[2] that automatically insert closing symbols. Even with the assistance, I've found it's easiest to continue typing through the closing symbols (as opposed to right arrowing).

The javascript is also less hairy without needing to handle typing braces together:)

[1] http://thechangelog.com/post/20172996073/vim-smartinput-smar... [2] http://emacswiki.org/emacs/ParEdit

moonbootson The keyboard layout project

I question whether these keyboard layouts are ideal for programmers. On Qwerty, Colemak, Dvorak, and Workman, the symbol keys are pushed to the periphery of the keyboard. To improve practical typing efficiency, I created and use http://typing.io, which allows you to type real code instead of prose.

moonbootson Enhancements to Shell and Vim Productivity

On linux caps lock can be mapped to both control and escape, depending on context.

https://github.com/alols/xcape

moonbootson A Modern Space Cadet

I'm hoping the split spacebar that Microsoft introduced[1] starts catching on with mechanical keyboard makers. The left side of the spacebar currently wastes valuable real estate. Putting another backspace key would move the most typed key into easy reach instead of forcing the right pinky to leap on every error.

On the topic of keyboard ergonomics, I also believe that all keyboards should be tenkeyless. It's another case of prioritizing an infrequent action (typing on the numpad) over a frequent action (moving the right hand to the mouse). Users who need a numpad can always get a standalone usb unit.

[1] http://reviews.cnet.com/keyboards/microsoft-sculpt-comfort-k...

moonbootson Faster than jQuery(document).ready() - Wait Until Exists

A simpler method is adding a blocking script tag immediately below the DOM element.

moonbootson Why we Disabled Google Checkout / Google Wallet on our Site

The payment processing fee structure almost incentivizes these customer support nonresponses. If I'm a small company experiencing technical problems with payments, I'm losing ~95% on each error while the payment processor is losing the remaining sliver. For a startup, these sales are critical, but for the payment processor, the fees on these low volume transactions are chump change. I can only hope a bigger customer is experiencing similar issues so the bug fix can be expedited. My only recourses are switching payment processors and generating some bad publicity through a blog post.

moonbootson SHA-3 to Be Announced

A hash function immune to length extension attacks is more fool-proof than HMAC because there is no additional construct required. It's also faster because it requires no additional passes over data.

moonbootson Octave dev demands money to release bugfix that he already wrote

I didn't get the impression that the developer would release the fixes without a donation.

moonbootson Show HN: Setup a fancy development environment ... on a linux system console

Browser support and fonts are also the things holding me back from doing more work without X. For clipboard support, try tmux[1], a screen alternative. I actually like the tmux clipboard more than X's because you can list and select from all previous copies/cuts. Tmux provides vi and emacs shortcuts to find and copy text from the console. The "tmux set-buffer" command can also be used in place of xclip.

[1] http://tmux.sourceforge.net/

moonbootson Web Fonts Performance: Making Pretty, Fast

Google and Typekit released a javascript project called web font loader[1] that allows custom fallback logic. You can add custom code that loads self-hosted fonts if Google is timing out. To generate the fonts on your server, you can download the original fonts[2] and run them through FontSquirrel's Font-Face Generator[3]. This provides some of the optimization benefits that Ilya mentions in his blog post.

[1] https://github.com/typekit/webfontloader [2] http://code.google.com/p/googlefontdirectory/ [3] http://www.fontsquirrel.com/fontface/generator

moonbootson Static Asset Compilation

Good tips. I've found that http://pngquant.org generates smaller pngs than optipng, but the former is lossy (reduced color palette). I can't tell the difference though.

moonbootson Web Fonts Performance: Making Pretty, Fast

Using a nice typeface provides an incredible boost to site design. I'm a very happy user of Google Web Fonts (PT Sans and Ubuntu Mono) on my site http://typing.io

Very small performance suggestion: minify the initial css!

moonbootson Whatthekeycode.com - quickly find a js keycode for any key

Chrome doesn't let pages capture shortcuts like ctrl+w and ctrl+t.

moonbootson Typing Practice for Programmers

Thanks. I will give your idea some thought. A related offshoot I've considered is allowing companies to upload private code for employee onboarding. New programmers to the company can type through common code, get a feel for the libraries, coding standards, etc.

moonbootson Typing Practice for Programmers

Are the typing mechanics different in latter/advanced lessons? If so, it's something I need look into. Or is this a different problem?

I preserved the whitespace the project authors used. I'm a little picky too regarding these details, but I want users to see code in its original form.

Thanks for the feedback

moonbootson Typing Practice for Programmers

Hmm, I'm not doing anything special. I just put the web font link at the top of head. I'm also only including the default font weight. How many assets does your page have? Typing.io is relatively slim, so the font download can occur relatively sooner. If I'm not mistaken, the initial css downloads blocks the page load, but the actual ttf/woff/etc download occurs async and may be delayed if there is other stuff.

moonbootson Typing Practice for Programmers

I agree that we're not typist in the sense that basketball players are not dribblers.